CVE-2026-95811 (GCVE-0-2026-95811)

Vulnerability from cvelistv5 – Published: 2026-09-25 01:31 – Updated: 2026-09-25 01:31
VLAI
Title
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it
Summary
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.
Severity
No CVSS data available.
CWE
  • CWE-863 - Incorrect Authorization
  • CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize
Assigner
References
Impacted products
Vendor Product Version CPE status
Affected: 2.0.0 , < 2.16.10 (custom)
Affected: 2.17.0 , < 2.21.6 (custom)
Affected: 2.22.0 , < 2.23.4 (custom)
Credits
Deepseek agent, Linagora
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "Lemonldap::NG::Handler"
          ],
          "packageName": "Lemonldap-NG-Handler",
          "packageURL": "pkg:cpan/Lemonldap-NG-Handler",
          "programFiles": [
            "lib/Lemonldap/NG/Handler/Main/Run.pm"
          ],
          "programRoutines": [
            {
              "name": "Lemonldap::NG::Handler::Main::Run::run"
            },
            {
              "name": "Lemonldap::NG::Handler::Main::Run::grant"
            },
            {
              "name": "Lemonldap::NG::Handler::Main::Run::getLevel"
            },
            {
              "name": "Lemonldap::NG::Handler::Main::Run::isUnprotected"
            }
          ],
          "repo": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng",
          "versions": [
            {
              "lessThan": "2.16.10",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.21.6",
              "status": "affected",
              "version": "2.17.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.23.4",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deepseek agent, Linagora"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost\u0027s locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost\u0027s default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-180",
              "description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T01:31:22.472Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3723"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.10"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-24660"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Lemonldap-NG-Handler 2.16.10, 2.21.6 or 2.23.4 or later. Only 2.23.4 is on CPAN; the 2.16.10 and 2.21.6 LTS releases are available from https://lemonldap-ng.org/download.html."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-95811",
    "datePublished": "2026-09-25T01:31:22.472Z",
    "dateReserved": "2026-09-22T15:43:06.362Z",
    "dateUpdated": "2026-09-25T01:31:22.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-95811",
      "date": "2026-09-25",
      "epss": "0.00252",
      "percentile": "0.14898"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://cpan.org/modules",
                "defaultStatus": "unaffected",
                "modules": [
                  "Lemonldap::NG::Handler"
                ],
                "packageName": "Lemonldap-NG-Handler",
                "packageURL": "pkg:cpan/Lemonldap-NG-Handler",
                "programFiles": [
                  "lib/Lemonldap/NG/Handler/Main/Run.pm"
                ],
                "programRoutines": [
                  {
                    "name": "Lemonldap::NG::Handler::Main::Run::run"
                  },
                  {
                    "name": "Lemonldap::NG::Handler::Main::Run::grant"
                  },
                  {
                    "name": "Lemonldap::NG::Handler::Main::Run::getLevel"
                  },
                  {
                    "name": "Lemonldap::NG::Handler::Main::Run::isUnprotected"
                  }
                ],
                "repo": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng",
                "versions": [
                  {
                    "lessThan": "2.16.10",
                    "status": "affected",
                    "version": "2.0.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "2.21.6",
                    "status": "affected",
                    "version": "2.17.0",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "2.23.4",
                    "status": "affected",
                    "version": "2.22.0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost\u0027s locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost\u0027s default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants."
          }
        ],
        "id": "CVE-2026-95811",
        "lastModified": "2026-09-25T13:22:04.673",
        "metrics": {},
        "published": "2026-09-25T02:16:54.677",
        "references": [
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3723"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.10"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://www.cve.org/CVERecord?id=CVE-2020-24660"
          }
        ],
        "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-180"
              },
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-09-25T06:01:58+00:00",
      "cve": "CVE-2026-95811",
      "id": "CVE-2026-95811",
      "initial_release_date": "2026-09-25T01:31:22.472000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "lemonldap-ng: lemonldap-ng: Access control bypass via non-normalized request URI",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-95811.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.